For our service I chose to end sessions at 4 AM local time, but have them last at least 8 hours. This means: * sessions last between 8 and 24+8 hours * if yo

For our service I chose to end sessions at 4 AM local time, but have them last at least 8 hours. This means: * sessions last between 8 and 24+8 hours * if you log in before 20:00, your session ends that night, if you log in after 20:00 it'll last one more day * since this is a B2B application users are unlikely to use the application during session expiry * it's possible to calculate the expiry time during log in and it doesn't require tracking session activity This approach should have similar security properties as a 24h logout, while minimizing the disruption users experience.